interpreting-culture-index

Pass

Audited by Gen Agent Trust Hub on Apr 29, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute a local Python script (scripts/extract_pdf.py) via uv run. This command is used to parse Culture Index PDF files and is part of the skill's core functionality with no remote code execution involved.\n- [EXTERNAL_DOWNLOADS]: The extraction script defines several standard Python dependencies (opencv-python-headless, numpy, pdf2image, pytesseract) that are downloaded from official package registries (PyPI) by the uv tool. These are well-known libraries for image processing and OCR.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external Culture Index PDF and JSON files. While the data is parsed into a structured format before interpretation, this ingestion represents a standard surface for potential indirect prompt injection if a source file contained malicious instructions.\n
  • Ingestion points: CI PDF and JSON input files processed via SKILL.md and workflows/extract-from-pdf.md.\n
  • Boundary markers: None explicitly mentioned to delimit extracted text from system instructions.\n
  • Capability inventory: Bash (used for extraction), Write (to save reports/JSON), Read, Grep, Glob.\n
  • Sanitization: The extraction script converts visual chart data and text into structured JSON fields before presentation to the AI, reducing the risk of accidental instruction obedience.\n- [SAFE]: The skill implements professional behavioral assessment interpretation logic, including comprehensive reference materials and structured workflows. It includes robust error handling and warnings against inaccurate visual estimation, aligning with industry best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 29, 2026, 01:46 PM